--- a/dom/webidl/BrowserElement.webidl
+++ b/dom/webidl/BrowserElement.webidl
@@ -146,17 +146,17 @@ interface BrowserElementPrivileged {
 
   [Throws,
    Pref="dom.mozBrowserFramesEnabled",
    ChromeOnly]
   DOMRequest setInputMethodActive(boolean isActive);
 
   [Throws,
    Pref="dom.mozBrowserFramesEnabled",
-   CheckAllPermissions="browser nfc-manager"]
+   ChromeOnly]
   void setNFCFocus(boolean isFocus);
 
   [Throws,
    Pref="dom.mozBrowserFramesEnabled",
    CheckAnyPermissions="browser"]
   void findAll(DOMString searchString, BrowserFindCaseSensitivity caseSensitivity);
 
   [Throws,

--- a/dom/webidl/MozIsoDepTech.webidl
+++ b/dom/webidl/MozIsoDepTech.webidl
@@ -1,13 +1,13 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-[Func="Navigator::HasNFCSupport", AvailableIn="PrivilegedApps",
+[Func="Navigator::HasNFCSupport", ChromeOnly,
  ChromeConstructor(MozNFCTag tag)]
 interface MozIsoDepTech {
   /**
    * Send raw ISO-DEP command to tag and receive the response.
    */
   [Throws]
   Promise<Uint8Array> transceive(Uint8Array command);
 };

--- a/dom/webidl/MozNFC.webidl
+++ b/dom/webidl/MozNFC.webidl
@@ -30,68 +30,66 @@ enum NfcErrorMessage {
 interface MozNFCManager {
   /**
    * API to check if the given application's manifest
    * URL is registered with the Chrome Process or not.
    *
    * Returns success if given manifestUrl is registered for 'onpeerready',
    * otherwise error
    */
-  [CheckAnyPermissions="nfc-manager", AvailableIn=CertifiedApps]
+  [ChromeOnly]
   Promise<boolean> checkP2PRegistration(DOMString manifestUrl);
 
   /**
    * Notify that user has accepted to share nfc message on P2P UI
    */
-  [CheckAnyPermissions="nfc-manager", AvailableIn=CertifiedApps]
+  [ChromeOnly]
   void notifyUserAcceptedP2P(DOMString manifestUrl);
 
   /**
    * Notify the status of sendFile operation
    */
-  [CheckAnyPermissions="nfc-manager", AvailableIn=CertifiedApps]
+  [ChromeOnly]
   void notifySendFileStatus(octet status, DOMString requestId);
 
   /**
    * Power on the NFC hardware and start polling for NFC tags or devices.
    */
-  [CheckAnyPermissions="nfc-manager", AvailableIn=CertifiedApps]
+  [ChromeOnly]
   Promise<void> startPoll();
 
   /**
    * Stop polling for NFC tags or devices. i.e. enter low power mode.
    */
-  [CheckAnyPermissions="nfc-manager", AvailableIn=CertifiedApps]
+  [ChromeOnly]
   Promise<void> stopPoll();
 
   /**
    * Power off the NFC hardware.
    */
-  [CheckAnyPermissions="nfc-manager", AvailableIn=CertifiedApps]
+  [ChromeOnly]
   Promise<void> powerOff();
 };
 
 [JSImplementation="@mozilla.org/nfc/manager;1",
  NavigatorProperty="mozNfc",
  Func="Navigator::HasNFCSupport",
- CheckAnyPermissions="nfc nfc-share",
- AvailableIn="PrivilegedApps",
+ ChromeOnly,
  UnsafeInPrerendering]
 interface MozNFC : EventTarget {
   /**
    * Indicate if NFC is enabled.
    */
   readonly attribute boolean enabled;
 
   /**
    * This event will be fired when another NFCPeer is detected, and user confirms
    * to share data to the NFCPeer object by calling mozNFC.notifyUserAcceptedP2P.
    * The event will be type of NFCPeerEvent.
    */
-  [CheckAnyPermissions="nfc-share", AvailableIn=CertifiedApps]
   attribute EventHandler onpeerready;
 
   /**
    * This event will be fired when a NFCPeer is detected. The application has to
    * be running on the foreground (decided by System app) to receive this event.
    *
    * The default action of this event is to dispatch the event in System app
    * again, and System app will run the default UX behavior (like vibration).

--- a/dom/webidl/MozNFCPeer.webidl
+++ b/dom/webidl/MozNFCPeer.webidl
@@ -3,33 +3,33 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  *
  * Part of this IDL file is from:
  * http://w3c.github.io/nfc/proposals/common/nfc.html#idl-def-NFCPeer
  *
  * Copyright © 2013 Deutsche Telekom, Inc.
  */
 
-[JSImplementation="@mozilla.org/nfc/peer;1", AvailableIn="PrivilegedApps"]
+[JSImplementation="@mozilla.org/nfc/peer;1", ChromeOnly]
 interface MozNFCPeer {
   /**
    * Indicate if this peer is already lost.
    */
   readonly attribute boolean isLost;
 
   /**
    * Send NDEF data to peer device.
    */
   [Throws]
   Promise<void> sendNDEF(sequence<MozNDEFRecord> records);
 
   /**
    * Send file to peer device.
    */
-  [Throws, CheckAnyPermissions="nfc-share", AvailableIn="CertifiedApps"]
+  [Throws]
   Promise<void> sendFile(Blob blob);
 };
 
 // Mozilla Only
 partial interface MozNFCPeer {
   [ChromeOnly]
   attribute DOMString session;
 

--- a/dom/webidl/MozNFCPeerEvent.webidl
+++ b/dom/webidl/MozNFCPeerEvent.webidl
@@ -1,17 +1,16 @@
 /* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
 [Constructor(DOMString type, optional MozNFCPeerEventInit eventInitDict),
- Func="Navigator::HasNFCSupport", CheckAnyPermissions="nfc nfc-share",
- AvailableIn="PrivilegedApps"]
+ Func="Navigator::HasNFCSupport", ChromeOnly]
 interface MozNFCPeerEvent : Event
 {
   /**
    * The detected NFCPeer.
    */
   readonly attribute MozNFCPeer? peer;
 };
 

--- a/dom/webidl/MozNFCTag.webidl
+++ b/dom/webidl/MozNFCTag.webidl
@@ -33,17 +33,17 @@ enum NFCTagType {
   "Type2",
   "Type3",
   "Type4",
   "MIFARE-Classic"
 };
 
 typedef (MozIsoDepTech or MozNfcATech) MozTagTech;
 
-[JSImplementation="@mozilla.org/nfc/tag;1", AvailableIn="PrivilegedApps"]
+[JSImplementation="@mozilla.org/nfc/tag;1", ChromeOnly]
 interface MozNFCTag {
   /**
    * The supported technologies of this tag, null if unknown.
    */
   [Cached, Pure] readonly attribute sequence<NFCTechType>? techList;
 
   /**
    * The identifier of this tag.

--- a/dom/webidl/MozNFCTagEvent.webidl
+++ b/dom/webidl/MozNFCTagEvent.webidl
@@ -1,17 +1,16 @@
 /* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
 [Constructor(DOMString type, optional MozNFCTagEventInit eventInitDict),
- Func="Navigator::HasNFCSupport", CheckAnyPermissions="nfc",
- AvailableIn="PrivilegedApps"]
+ Func="Navigator::HasNFCSupport", ChromeOnly]
 interface MozNFCTagEvent : Event
 {
   /**
    * The detected NFCTag.
    */
   readonly attribute MozNFCTag? tag;
 
   /**

--- a/dom/webidl/MozNfcATech.webidl
+++ b/dom/webidl/MozNfcATech.webidl
@@ -1,13 +1,13 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-[Func="Navigator::HasNFCSupport", AvailableIn="PrivilegedApps",
+[Func="Navigator::HasNFCSupport", ChromeOnly,
  ChromeConstructor(MozNFCTag tag)]
 interface MozNfcATech {
   /**
    * Send raw NFC-A command to tag and receive the response.
    */
   [Throws]
   Promise<Uint8Array> transceive(Uint8Array command);
 };

--- a/dom/webidl/SecureElement.webidl
+++ b/dom/webidl/SecureElement.webidl
@@ -32,18 +32,17 @@ dictionary SECommand {
   required octet p1;             // First Octet of Parameters Byte
   required octet p2;             // Second Octet of Parameters Byte
   sequence<octet>? data = null;  // Sequence of octets
   short le = -1;                 // The length of the expected
                                  // response data or -1 if none is expected
 };
 
 [Pref="dom.secureelement.enabled",
- CheckAnyPermissions="secureelement-manage",
- AvailableIn="CertifiedApps",
+ ChromeOnly,
  JSImplementation="@mozilla.org/secureelement/reader;1"]
 interface SEReader {
 
   // 'true' if a secure element is present
   readonly attribute boolean isSEPresent;
 
   // Type of SecureElement
   readonly attribute SEType type;
@@ -61,18 +60,17 @@ interface SEReader {
    * Closes all sessions associated with this Reader and its associated channels.
    *
    */
   [Throws]
   Promise<void> closeAll();
 };
 
 [Pref="dom.secureelement.enabled",
- CheckAnyPermissions="secureelement-manage",
- AvailableIn="CertifiedApps",
+ ChromeOnly,
  JSImplementation="@mozilla.org/secureelement/session;1"]
 interface SESession {
 
   // 'reader' that provides this session
   readonly attribute SEReader reader;
 
   // Status of current session
   readonly attribute boolean isClosed;
@@ -97,18 +95,17 @@ interface SESession {
    * Close all active channels associated with this session.
    *
    */
   [Throws]
   Promise<void> closeAll();
 };
 
 [Pref="dom.secureelement.enabled",
- CheckAnyPermissions="secureelement-manage",
- AvailableIn="CertifiedApps",
+ ChromeOnly,
  JSImplementation="@mozilla.org/secureelement/channel;1"]
 interface SEChannel {
 
   // 'session' obj this channel is bound to
   readonly attribute SESession session;
 
   // response to openBasicChannel / openLogicalChannel operation
   [Constant, Cached] readonly  attribute Uint8Array? openResponse;
@@ -137,18 +134,17 @@ interface SEChannel {
    * Closes the active channel.
    *
    */
   [Throws]
   Promise<void> close();
 };
 
 [Pref="dom.secureelement.enabled",
- CheckAnyPermissions="secureelement-manage",
- AvailableIn="CertifiedApps",
+ ChromeOnly,
  JSImplementation="@mozilla.org/secureelement/response;1"]
 interface SEResponse {
   // Response received on this 'channel' object.
   [Constant] readonly attribute SEChannel channel;
 
   // First octet of response's status word
   [Constant] readonly attribute octet        sw1;
 

--- a/dom/webidl/SecureElementManager.webidl
+++ b/dom/webidl/SecureElementManager.webidl
@@ -1,17 +1,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
  /* Copyright © 2014 Deutsche Telekom, Inc. */
 
 [Pref="dom.secureelement.enabled",
- CheckAnyPermissions="secureelement-manage",
- AvailableIn="CertifiedApps",
+ ChromeOnly,
  JSImplementation="@mozilla.org/secureelement/manager;1",
  NavigatorProperty="seManager",
  NoInterfaceObject]
 interface SEManager {
 
   /**
    * Retrieves all the readers available on the device.
    *